# Permission Errors

**URL:** <https://discuss.elastic.co/t/permission-errors/85479>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 11, 2017, 8:46pm UTC](https://discuss.elastic.co/t/permission-errors/85479 "2017-05-11T20:46:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Scott\_Robinson](https://avatars.discourse-cdn.com/v4/letter/s/f1d935/32.png) [@Scott\_Robinson](https://discuss.elastic.co/u/Scott_Robinson)\
**Post date:** [May 11, 2017, 8:46pm UTC](https://discuss.elastic.co/t/permission-errors/85479/1 "2017-05-11T20:46:51Z")

</div>

Howdy,

Can I get filebeat to ignore permission errors and carry on reading other files?

2017-05-11T20:41:19Z ERR Failed opening /var/log/mediator/sysman.log: open /var/log/mediator/sysman.log: permission denied  
2017-05-11T20:41:19Z ERR Stop Harvesting. Unexpected file opening error: open /var/log/mediator/sysman.log: permission denied

If it reaches a file it cannot read, it will just stop completely.

---

<div class="post-metadata">

**Author:** ![Scott\_Robinson](https://avatars.discourse-cdn.com/v4/letter/s/f1d935/32.png) [@Scott\_Robinson](https://discuss.elastic.co/u/Scott_Robinson)\
**Post date:** [May 13, 2017, 8:38pm UTC](https://discuss.elastic.co/t/permission-errors/85479/2 "2017-05-13T20:38:24Z")

</div>

Bump

---

<div class="post-metadata">

**Author:** ![Xavy](https://avatars.discourse-cdn.com/v4/letter/x/e0b2c6/32.png) [@Xavy](https://discuss.elastic.co/u/Xavy)\
**Post date:** [May 13, 2017, 10:05pm UTC](https://discuss.elastic.co/t/permission-errors/85479/3 "2017-05-13T22:05:18Z")

</div>

Hello:

You exclude particular files within a previously configured log path. For instance if you added the default path:

```
paths:
    - /var/log/*.log

```

You could add the below configuration (which is already present on config file but commented):

```
# Exclude files. A list of regular expressions to match. Filebeat drops the files that
# are matching any regular expression from the list. By default, no files are dropped.

exclude_files: ['^/var/log/mediator/sysman.log$']

```

Please note that you would to do this for every file you wished to include (or define a regular expression matching all of them, and only those to exlude)

Additionally if you do want to add this logs to what filebeat sends, you could add filebeat user to the group owning that file/folder. It will depend on the permissions but it would de really strange if then filebeat could not read the file.

Obviously the ideal solution would be devels creating a PR correcting this for future versions, but this workaround should be good enough to keep things working.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 14, 2017, 10:20am UTC](https://discuss.elastic.co/t/permission-errors/85479/4 "2017-05-14T10:20:21Z")

</div>

Feel free to open a [bug report](https://github.com/elastic/beats/issues) for filebeat stopping if some files are not readable.

---

<div class="post-metadata">

**Author:** ![Scott\_Robinson](https://avatars.discourse-cdn.com/v4/letter/s/f1d935/32.png) [@Scott\_Robinson](https://discuss.elastic.co/u/Scott_Robinson)\
**Post date:** [May 14, 2017, 12:15pm UTC](https://discuss.elastic.co/t/permission-errors/85479/5 "2017-05-14T12:15:00Z")

</div>

Thanks both for your suggestions - Much appreciated.

Exclude files would work temporarily, but filebeat would then 'break' again if someone decided to add another application that doesn't have the correct permissions... But I might give that one a try 🙂

I shall submit a bug report now - Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2017, 12:23pm UTC](https://discuss.elastic.co/t/permission-errors/85479/6 "2017-06-11T12:23:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
